BookStack v26.05.5

14 September 2026 om 16:02

Security Release

This is a security release which addresses a vulnerability related to social login accounts, to prevent accounts from different services being potentially mis-matched.

Upgrading is strongly advised if the instance has ever used more than one third-party/social login option (including previously used options which are no longer active).

Thanks to Google and Ada Logics for the discovery and responsible disclosure of this issue.

Full List of Changes

Updated social logins to scope social account queries to social system.
Updated PHP package versions.

v2.11.1

Arcane

Door: kmendell

13 September 2026 om 23:26

Note

This release fixes authentication, vulnerability-management, and Docker compatibility issues.
It also improves file-mode preservation, project navigation, notifications, and dashboard reliability.

Authentication and notifications

Align first-login password validation with the configured policy — b71892d0902480a5e430bf4c10439d167508301c (@kmendell)
Prevent passkey MFA failures caused by reactive options — 95e5a3bc14706e69a9a366794d92706c55a53a7f (#3926) (@kmendell)
Preserve notification event subscriptions during partial settings updates and warn when none are subscribed — 817444abbd7984401e9f2e3ef59447e474f8d97b (#3925) (@kmendell)

Vulnerability management and Docker compatibility

Fall back to cpuset for Trivy when the Docker host lacks CFS quota support — 41eae6334d8807d7fd7c159b73f157b28422e2a8 (#3910) (@kmendell)
Allow vulnerability management to be disabled per environment — 4e432b30a69458c2077f9eac5ceb1a83709282b6 (#3914) (@kmendell)
Pull pre-deploy runner images using configured registry credentials — 989e160ec544842d0db69ade182037cd2976b310 (#3918) (@kmendell)
Fail image patching early when Docker lacks the containerd image store — 6fdcf37c2dba690a227d09e1bf5aaf3a3c632330 (#3928) (@kmendell)

Projects and GitOps

Preserve existing file modes when saving project and global environment files — c92f3932cca1597c3d3fe3484b3d9a1e41289216 (#3919) (@kmendell)
Preserve configured directory modes for GitOps directory-sync project roots — 31081659de472c06a639bd53e1615dff5077b5ac (#3920) (@kmendell)
Treat identity bind mounts as mapped when re-resolving escaped relative Compose paths — 7b19b854ace736bedafd0a632e8cb54f3420696a (#3924) (@kmendell)
Sort projects by live status instead of the stale persisted status — 0b594d1fd17c50285d9e7956f7bc8a488200c27b (#3923) (@kmendell)

Interface and dashboard

Keep the environment detail page stable when navigating back to the list — 73d478211ebe090dc5afe38c098361e2b5770472 (#3921) (@kmendell)
Prevent the project log panel from recursing on the viewer stop callback — e8cc329c1042b896669ae091d64e6a8cbd15bf0f (#3927) (@kmendell)
End dashboard statistics loading on stream failure and retry on refresh — 16b7b59d5e6442bd8d2e0181356fb8f5d6488ebc (#3930) (@kmendell)